Information and help with Windows svchost.exe

Question

Information and help with Windows svchost.exe.

Answer

What is the svchost.exe file?

Microsoft Windows executable file labeled as: Generic Host Process for Win32 Services. This is a required Windows file and is used to load needed DLL files that are used with Microsoft Windows and Windows programs that run on your computer.

This file is located in either the c:\windows\system32 or c:\winnt\system32 directories depending on your version of Windows and may also be located in the dllcache directory if present.

Why do I have multiple svchost.exe processes running in Task Manager?

Multiple svchost.exe files are loaded when a program needs to be grouped from other Windows services. This is a normal operation of Windows and it is common to see three or four svchost.exe in the Task Manager processes.

Is svchost.exe a virus or trojan?

There are viruses that can infect this file and may run as a SVCHOST.EXE service. If you think your computer may be infected with a computer virus that is causing problems with this service, we recommend you update your virus protection program and visit the Microsoft Windows update page instead of attempting to manually fix the problem.

If your antivirus protection software does not detect a virus or other malware your computer is not infected and the svchost.exe file is not a virus.

SVCHOST.EXE error with 0xe03c3a68 or computer crashes with this file when opening Microsoft Internet Explorer  

Users experiencing an error with the above memory address are infected with the blaster virus.

How can I remove svchost.exe?

This file is an important Windows file and needed by Windows. Removing this file would cause Windows to no longer function. If this file is infected with a virus your antivirus program should be able to quarantine or delete the file.

How can I view what applications svchost is handling?

To determine what are in the svchost.exe file you will need either tlist.exe if you are running Windows 2000, or tasklist.exe if you are running Windows XP. Windows users can also view what is running under svchost through Windows defender.

Running the tlist and tasklist program

Windows XP users can run this program by clicking Start, Run, and type command or cmd and press enter. From the MS-DOS prompt, type tasklist /svc and press enter.

Windows 2000 users can run this program by clicking Start, Run, and type command or cmd and press enter. From the MS-DOS prompt, type tlist -s and press enter.

* If you are unable to run or locate this file on the computer, see below steps on installing this file onto your computer. 

Tasklist Windows XP Installation

Windows XP Home users will need to download the tasklist.exe file from our Windows XP download section.

Windows XP Professional users that are unable to locate this file can expand it from the i386 directory on their Windows XP Professional CD or download the file from the above link. Unfortunately, the Windows XP Home CD does not contain this file.

Tlist Windows 2000 Installation

If you do not have this file you will need to install the Microsoft Windows 2000 support tools. To do this, place the Windows 2000 CD into the computer and run setup.exe from \SUPPORT\TOOLS directory.

Example of what is seen in tlist and tasklist

Below is an example of what the Windows XP output of tasklist may look like.
 

Image Name	PID	Session Name	Session#	Mem Usage
=========================	======	================	========	============
cmd.exe	6076	Console	0	132 K
notepad.exe	1152	Console	0	2,660 K
firefox.exe	5868	Console	0	397,008 K
SecureCRT.EXE	4288	Console	0	10,968 K
thunderbird.exe	1812	Console	0	54,572 K
notepad.exe	532	Console	0	1,584 K
perl.exe	1528	Console	0	48,936 K

Below is an example of what Windows 2000 would display for the svchost services. With tlist.exe or tasklist.exe you should see information similar to the below example.

444 svchost.exe Svcs: RpcSs
552 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
792 svchost.exe Svcs: wuauserv

Viewing running processes through Windows defender

Microsoft Windows Defender is also capable of viewing all applications and processes running including those within svchost can be found through Windows Defender as explained below.

1. These steps require that you have Windows Defender installed on your computer.
2. Open Windows Defender if not already open by clicking Start, Programs, and clicking Windows Defender.
3. Click Tools.
4. Click Software Explorer.
5. Click the down arrow next to Category and click Currently Running Programs.

Any "Microsoft Generic Host Process for Win32 Services" for Windows XP users or "Microsoft(R) Windows (R) 2000 Operating System" items listed in the list are portions of the svchost.